521–530 of 634 posts
Hi everyone, thanks for all the enthusiasm about this change. We are happy to have removed cookie banners from GitHub, and not to participate in third-party tracking of user behavior.
Our privacy policies and subprocessor list will be updated next week following our customary 30 day user notice period. We do this in the open in a pull request, so you can see the changes now:
(GitHub CEO) Hi everyone, thanks for all the enthusiasm about this change. We are happy to have removed cookie banners from GitHub, and not to participate in third-party tracking of user behavior. Our privacy policies and subprocessor list will be updated next week following our customary 30 day user notice period. We do this in the open in a pull request, so you can see the changes now: https://github.com/github/sit…
(GitHub CEO) Hi everyone, thanks for all the enthusiasm about this change. We are happy to have removed cookie banners from GitHub, and not to participate in third-party tracking of user behavior. Our privacy policies and subprocessor list will be updated next week following our customary 30 day user notice period. We do this in the open in a pull request, so you can see the changes now: https://github.com/github/sit…
Earlier quoted context omitted.
Came here to say this. Eliminating Google analytics is unequivocally a good thing. A strong B+ assessment. But the blog doesn't say anything about eliminating _tracking_. Personally, I can live with analysis that's used solely for product improvement. If that's all github is doing, then the score goes up to an A. But if they're siphoning off data for any other purposes - whether passing to the mother ship or otherwis…
Why do you think changing the implementation to the server side will comply with the letter of the law? Or perhaps I should ask which law. GDPR doesn't differentiate between the client side or server side, you're simply not allowed to keep information on users unless they've consented to for it to be kept or it is required for a legitimate functionality to which they have consented.
If they're not using Google Analytics anymore, it's probably time to remove the request to 'gascrolldepth.js' from the blog as well.
Earlier quoted context omitted.
Why do you think changing the implementation to the server side will comply with the letter of the law? Or perhaps I should ask which law. GDPR doesn't differentiate between the client side or server side, you're simply not allowed to keep information on users unless they've consented to for it to be kept or it is required for a legitimate functionality to which they have consented.
So I am not allowed to keep server logs without consent?
You also should be trying to scrub IP adresses from those logs as that counts as PII.
Until now GitHub has sent client-side requests to Google Analytics with a client ID that was also sent in a second client-side request to an in-house analytics API at GitHub for augmenting and cross-referencing user data. The client-side Google Analytics request no longer appears to be sent, but a request containing personal data is still sent to collector.githubapp.com. The privacy policy page which lists third part…
Came here to say this. Eliminating Google analytics is unequivocally a good thing. A strong B+ assessment. But the blog doesn't say anything about eliminating _tracking_. Personally, I can live with analysis that's used solely for product improvement. If that's all github is doing, then the score goes up to an A. But if they're siphoning off data for any other purposes - whether passing to the mother ship or otherwis…
This is great! GitHub continues to, somehow, surprise me. One question I do have, however, is whether or not the new homepage[0] which shows where people are when they open a PR actually reveals their present location. In the few samples I checked it did not seem that the presence of the person indicated matched their bio's location settings. If it is truly unmasking people's location I think it should be opt-in only…
Earlier quoted context omitted.
GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been updated. See my comment below for details: https://news.ycombinator.com/item?id=25458635 Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of…
A GitHub spokesperson has issued this statement [1] about a request to api.github.com: "That endpoint tracks aggregate performance metrics, and does not rely on cookies or other unique identifiers". GitHub is still sending our usernames and other unique IDs, our device data, and the pages we visit to the collector.githubapp.com endpoint. GitHub's claims about not tracking users are false, they do identify users in tr…